- nsig name resolution: route direct-vs-array on capture-group PARTICIPATION,
not declared-group count (regexes 6/7 carry an optional array group) — a
direct-call player.js shape no longer hard-fails NsigArrayLookupFailed.
- nsig fixup_function: also strip the `if(typeof X==="undefined")return a;`
guard on the `function name(a){...}` body shape (previously required a
leading `;`), so the regex-fallback shape no longer silently yields an
identity result that gets cached as a permanent throttle.
- player_manager: never hold the state lock across the network; serialize
player.js downloads behind a fetch gate; add a per-artifact failure memo
(5-min cooldown) so a persistently-broken player.js costs one refetch per
open instead of a ~20-25 x 1.7MB storm. Transient-rotation self-heal
preserved (eval failure -> invalidate + refetch, no memo).
- errors no longer leak watch URLs / video ids: From<reqwest::Error> uses
without_url(); Recaptcha + link errors reduce to scheme+host (paths like
/embed/<id> and /shorts/<id> carried the id in the path).
- revive tests/ after the strawcore-core rename; js_phase2_offline green.
133 lib + 7 integration tests, clippy -D clean.
